fix(organizations): respect inherited access when inviting members (#8131)

* fix(organizations): respect inherited access when inviting members

* fix(organizations): recheck inherited access under invitation locks

* fix(organizations): verify effective access across invitation flows

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -132,13 +132,13 @@ jobs:
           lib/workspaces/organization-workspaces.postgres.test.ts
           lib/billing/calculations/usage-reservation.test.ts
 
-      - name: Verify access request pagination and impact in PostgreSQL
+      - name: Verify access request flows, pagination, and impact in PostgreSQL
         working-directory: apps/sim
         env:
           ACCESS_REQUESTS_TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_access_requests_test
         run: |
           bun -e 'import postgres from "postgres"; const sql = postgres(process.env.DATABASE_URL); await sql.unsafe("CREATE DATABASE sim_access_requests_test"); await sql.end()'
-          bunx vitest run ee/access-requests/lib/repository.postgres.test.ts ee/access-requests/lib/impact.postgres.test.ts
+          bunx vitest run ee/access-requests/lib/repository.postgres.test.ts ee/access-requests/lib/impact.postgres.test.ts ee/access-requests/lib/application/flow.postgres.test.ts
 
       - name: Verify fork previews ignore execution file history in PostgreSQL
         working-directory: apps/sim

apps/sim/ee/access-requests/lib/application/flow.postgres.test.ts

@@ -1,5 +1,9 @@
 import { z } from 'zod'
-import { organizationIdSchema, workspaceIdSchema } from '@/lib/api/contracts/primitives'
+import {
+  organizationIdSchema,
+  withMissingFieldMessage,
+  workspaceIdSchema,
+} from '@/lib/api/contracts/primitives'
 import { defineRouteContract } from '@/lib/api/contracts/types'
 import { PERMISSION_GROUP_FIELDS } from '@/lib/permission-groups/fields'
 import {
@@ -147,14 +151,20 @@ export const resolveAccessRequestBodySchema = z.discriminatedUnion('action', [
   z
     .object({
       action: z.literal('apply'),
-      expectedFingerprint: fingerprintSchema,
+      expectedFingerprint: withMissingFieldMessage(
+        fingerprintSchema,
+        'expectedFingerprint is required; preview the request before applying it'
+      ),
       newLimitCredits: usageLimitSchema.optional(),
     })
     .strict(),
   z
     .object({
       action: z.literal('decline'),
-      reason: reasonSchema.min(1, 'Explain why this request was declined'),
+      reason: withMissingFieldMessage(
+        reasonSchema.min(1, 'Explain why this request was declined'),
+        'reason is required when declining a request'
+      ),
     })
     .strict(),
 ])

apps/sim/lib/api/contracts/access-requests.ts

@@ -2,6 +2,8 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
+import { resolveAccessRequestBodySchema } from '@/lib/api/contracts/access-requests'
+import { v2ResolveAccessRequestBodySchema } from '@/lib/api/contracts/v2/access-requests'
 import { v2KnowledgeSearchBodySchema } from '@/lib/api/contracts/v2/knowledge'
 import { v2CreateSkillBodySchema } from '@/lib/api/contracts/v2/skills'
 import { v2CreateWorkflowBodySchema } from '@/lib/api/contracts/v2/workflows'
@@ -16,6 +18,42 @@ function messageAt(
   return result.error?.issues.find((issue) => issue.path[0] === field)?.message
 }
 
+describe.each([
+  ['internal', resolveAccessRequestBodySchema],
+  ['v2', v2ResolveAccessRequestBodySchema],
+] as const)('%s access request decisions name missing required fields', (_surface, schema) => {
+  it.each([
+    [
+      'apply',
+      'expectedFingerprint',
+      'expectedFingerprint is required; preview the request before applying it',
+    ],
+    ['decline', 'reason', 'reason is required when declining a request'],
+  ] as const)('names the missing field for %s', (action, field, message) => {
+    expect(messageAt(schema.safeParse({ action }), field)).toBe(message)
+    expect(messageAt(schema.safeParse({ action, [field]: 123 }), field)).toBe(
+      'Invalid input: expected string, received number'
+    )
+  })
+
+  it('preserves decision validation and trimming', () => {
+    expect(schema.safeParse({ action: 'apply', expectedFingerprint: '' }).success).toBe(false)
+    expect(
+      schema.safeParse({ action: 'apply', expectedFingerprint: 'x'.repeat(129) }).success
+    ).toBe(false)
+    expect(schema.safeParse({ action: 'decline', reason: '   ' }).success).toBe(false)
+    expect(schema.safeParse({ action: 'decline', reason: 'x'.repeat(1001) }).success).toBe(false)
+    expect(schema.parse({ action: 'apply', expectedFingerprint: 'reviewed' })).toEqual({
+      action: 'apply',
+      expectedFingerprint: 'reviewed',
+    })
+    expect(schema.parse({ action: 'decline', reason: ' Not needed ' })).toEqual({
+      action: 'decline',
+      reason: 'Not needed',
+    })
+  })
+})
+
 /**
  * A required field that is *omitted* and one that is *wrong-typed* are different
  * mistakes. Both used to answer with wording that pointed at the other: the

apps/sim/lib/api/contracts/v2/required-field-messages.test.ts

@@ -740,6 +740,195 @@ describe('Enterprise creation invitations', () => {
     })
   })
 
+  it.each(['admin', 'owner'] as const)(
+    'recognizes inherited organization %s access without explicit workspace grants',
+    async (role) => {
+      const payload = operationPayload({
+        request: {
+          ...operationPayload().request,
+          workspaceIds: ['workspace-1', 'workspace-2'],
+        },
+        applicationResult: {
+          appliedAt: '2026-08-13T00:00:00.000Z',
+          subscriptionId: 'sub-1',
+        },
+      })
+      queueTableRows(schemaMock.outboxEvent, [
+        { eventType: 'stripe.provision-enterprise', payload },
+      ])
+      queueTableRows(schemaMock.outboxEvent, [])
+      queueTableRows(schemaMock.outboxEvent, [{ status: 'completed' }, { status: 'completed' }])
+      queueTableRows(
+        schemaMock.user,
+        ['workspace-1', 'workspace-2'].map((workspaceId) => ({
+          userId: 'invitee-1',
+          workspaceId,
+          role,
+          permission: null,
+        }))
+      )
+      const checkpointPayload = vi.fn()
+
+      await inviteEnterprisePeople(
+        {
+          provisioningOperationId: 'operation-1',
+          organizationId: 'org-1',
+          ownerUserId: 'owner-1',
+          email: 'new@example.com',
+          role: 'admin',
+          permission: 'admin',
+          sequence: 0,
+        },
+        {
+          eventId: 'invite-1',
+          eventType: 'enterprise.invite-people',
+          attempts: 0,
+          checkpointPayload,
+        }
+      )
+
+      expect(checkpointPayload).toHaveBeenCalledExactlyOnceWith({
+        delivery: {
+          completedAt: expect.any(String),
+          resultId: 'invitee-1',
+          outcome: 'unchanged',
+        },
+      })
+      expect(mocks.createWorkspaceInvitation).not.toHaveBeenCalled()
+      expect(mocks.prepareWorkspaceInvitationContext).not.toHaveBeenCalled()
+      expect(mocks.sendInvitationEmail).not.toHaveBeenCalled()
+    }
+  )
+
+  it.each([
+    {
+      name: 'a concurrent promotion',
+      role: 'admin',
+      permission: null,
+      requestedRole: 'member',
+      workspaceIds: ['workspace-1'],
+      applied: true,
+    },
+    {
+      name: 'a sufficient explicit grant',
+      role: 'member',
+      permission: 'write',
+      requestedRole: 'member',
+      workspaceIds: ['workspace-1'],
+      applied: true,
+    },
+    {
+      name: 'an insufficient explicit grant',
+      role: 'member',
+      permission: 'read',
+      requestedRole: 'member',
+      workspaceIds: ['workspace-1'],
+      applied: false,
+    },
+    {
+      name: 'a workspace leaving the organization scope',
+      role: null,
+      permission: null,
+      requestedRole: 'member',
+      workspaceIds: ['workspace-1'],
+      applied: false,
+    },
+    {
+      name: 'a workspace admin grant without the requested organization admin role',
+      role: 'member',
+      permission: 'admin',
+      requestedRole: 'admin',
+      workspaceIds: ['workspace-1'],
+      applied: false,
+    },
+    {
+      name: 'inherited access to only one of two requested workspaces',
+      role: 'admin',
+      permission: null,
+      requestedRole: 'member',
+      workspaceIds: ['workspace-1', 'workspace-2'],
+      applied: false,
+    },
+  ] as const)(
+    'checks the final effective access after $name',
+    async ({ role, permission, requestedRole, workspaceIds, applied }) => {
+      const payload = operationPayload({
+        request: { ...operationPayload().request, workspaceIds: [...workspaceIds] },
+        applicationResult: {
+          appliedAt: '2026-08-13T00:00:00.000Z',
+          subscriptionId: 'sub-1',
+        },
+      })
+      queueTableRows(schemaMock.outboxEvent, [
+        { eventType: 'stripe.provision-enterprise', payload },
+      ])
+      queueTableRows(schemaMock.outboxEvent, [])
+      queueTableRows(
+        schemaMock.outboxEvent,
+        workspaceIds.map(() => ({ status: 'completed' }))
+      )
+      queueTableRows(schemaMock.user, [
+        { userId: 'invitee-1', workspaceId: 'workspace-1', role: 'member', permission: null },
+      ])
+      queueTableRows(schemaMock.invitation, [])
+      queueTableRows(schemaMock.user, [{ organizationId: 'org-1' }])
+      queueTableRows(schemaMock.user, [
+        { id: 'owner-1', name: 'Owner', email: 'owner@example.com' },
+      ])
+      queueTableRows(
+        schemaMock.user,
+        role ? [{ userId: 'invitee-1', workspaceId: 'workspace-1', role, permission }] : []
+      )
+      queueTableRows(schemaMock.invitation, [])
+      mocks.createWorkspaceInvitation.mockResolvedValueOnce({
+        id: 'invitee-1',
+        instantAdd: true,
+        outcome: 'unchanged',
+        workspaceIds: [],
+      })
+      const checkpointPayload = vi.fn()
+      const result = inviteEnterprisePeople(
+        {
+          provisioningOperationId: 'operation-1',
+          organizationId: 'org-1',
+          ownerUserId: 'owner-1',
+          email: 'new@example.com',
+          role: requestedRole,
+          permission: 'write',
+          sequence: 0,
+        },
+        {
+          eventId: 'invite-1',
+          eventType: 'enterprise.invite-people',
+          attempts: 0,
+          checkpointPayload,
+        }
+      )
+
+      if (applied) {
+        await expect(result).resolves.toBeUndefined()
+        expect(checkpointPayload).toHaveBeenLastCalledWith({
+          delivery: {
+            completedAt: expect.any(String),
+            resultId: 'invitee-1',
+            outcome: 'unchanged',
+          },
+        })
+      } else {
+        await expect(result).rejects.toThrow(
+          'did not apply the requested organization role and workspace permissions'
+        )
+        expect(checkpointPayload).toHaveBeenCalledExactlyOnceWith({
+          attemptedAt: expect.any(String),
+        })
+      }
+      expect(mocks.createWorkspaceInvitation).toHaveBeenCalledExactlyOnceWith(
+        expect.objectContaining({ existingAccessPolicy: 'ensure-at-least' })
+      )
+      expect(mocks.sendInvitationEmail).not.toHaveBeenCalled()
+    }
+  )
+
   it('waits without consuming attempts until every selected workspace move completes', async () => {
     const payload = operationPayload({
       request: {

apps/sim/lib/billing/enterprise-provisioning.test.ts

@@ -2746,36 +2746,50 @@ async function resolveEnterpriseInvitationApplicationState(
   workspaceIds: string[]
 ): Promise<EnterpriseInvitationApplicationState> {
   const normalizedEmail = normalizeEmail(payload.email)
-  const [existingUser] = await db
-    .select({ id: user.id, organizationId: member.organizationId, role: member.role })
+  const accessRows = await db
+    .select({
+      userId: user.id,
+      workspaceId: workspace.id,
+      role: member.role,
+      permission: permissions.permissionType,
+    })
     .from(user)
-    .leftJoin(member, eq(member.userId, user.id))
-    .where(eq(user.normalizedEmail, normalizedEmail))
-    .limit(1)
-  const roleSatisfied =
-    existingUser?.organizationId === payload.organizationId &&
-    (payload.role === 'member' || isOrgAdminRole(existingUser.role))
-  if (existingUser && roleSatisfied) {
-    const accessRows = await db
-      .select({ workspaceId: permissions.entityId, permission: permissions.permissionType })
-      .from(permissions)
-      .where(
-        and(
-          eq(permissions.entityType, 'workspace'),
-          eq(permissions.userId, existingUser.id),
-          inArray(permissions.entityId, workspaceIds)
-        )
+    .innerJoin(
+      member,
+      and(eq(member.userId, user.id), eq(member.organizationId, payload.organizationId))
+    )
+    .innerJoin(
+      workspace,
+      and(
+        eq(workspace.organizationId, member.organizationId),
+        inArray(workspace.id, workspaceIds),
+        isNull(workspace.archivedAt)
       )
-    const accessByWorkspace = new Map(
-      accessRows.map((row) => [row.workspaceId, row.permission] as const)
     )
-    if (
-      workspaceIds.every((workspaceId) =>
-        permissionSatisfies(accessByWorkspace.get(workspaceId), payload.permission)
+    .leftJoin(
+      permissions,
+      and(
+        eq(permissions.entityType, 'workspace'),
+        eq(permissions.userId, user.id),
+        eq(permissions.entityId, workspace.id)
       )
-    ) {
-      return { kind: 'applied', resultId: existingUser.id }
-    }
+    )
+    .where(eq(user.normalizedEmail, normalizedEmail))
+  const accessByWorkspace = new Map(accessRows.map((row) => [row.workspaceId, row] as const))
+  const existingUserId = accessRows[0]?.userId
+  if (
+    existingUserId &&
+    workspaceIds.every((workspaceId) => {
+      const access = accessByWorkspace.get(workspaceId)
+      if (!access) return false
+      const inheritsAdmin = isOrgAdminRole(access.role)
+      return (
+        (payload.role === 'member' || inheritsAdmin) &&
+        (inheritsAdmin || permissionSatisfies(access.permission, payload.permission))
+      )
+    })
+  ) {
+    return { kind: 'applied', resultId: existingUserId }
   }
 
   const pendingRows = await db